4 ms·
From what you are explaining, I doubt they know enough to know that you downloaded the files. In a case where the CC's are stored in the db, it's a really easy
by gexla 16y ago
From what you are explaining, I doubt they know enough to know that you downloaded the files. In a case where the CC's are stored in the db, it's a really easy mistake to make accidentally downloading the CC's by doing a db dump. I do this for many of my projects just so that I have a backup in case I screw something up. If they were worried about something like this happening then they should have warned you or put it in a contract.
Alert the client. Shred the files. Offer to fix.
- blaines 16y agoYou keep a copy of credit card numbers and CVV unencrypted in a database? Why wouldn't you use a third party/gateway to deal with CC data storage?
- tzs 16y agoWhen you use the gateway to store the CC data, then with most gateways you are stuck doing all future subscription billing on that card through that gateway. For many businesses, that is an unacceptable restriction.
- blaines 16y agoOh well that makes some sense - hopefully other companies are encrypting the data and not storing CVV. The crazy part to me is that these guys are storing this information for years (One of the first rows was from 2002, and the last 2010) and they're not doing any kind of recurring billing/customer profile stuff. So if I make a purchase 10 times my card is stored 10 times. To top it off, I went back on it while writing the client, and I don't even need a password to access data. I can create a valid session by setting a url parameter. :(
- gexla 16y agoHehe, no, I was talking about grabbing a copy of the database. We are assuming no knowledge that the database carries copies of CC #'s, or he wouldn't have done it. ;)